MTA-7134-LLM-Proxy-Transaction-Logging-Schema-Audit-Trail-Integration#379
Conversation
|
Warning Review limit reached
Next review available in: 16 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR adds a new documentation page describing how to audit and monitor LLM proxy interactions in the MTA Developer Lightspeed setup, covering log access via oc logs, the transaction log JSON schema, and SIEM/log aggregator forwarding configuration. The master guide is updated to include this new topic. ChangesLLM Proxy Auditing Documentation
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/topics/developer-lightspeed/proc_auditing-llm-proxy-transactions.adoc`:
- Around line 27-30: Update the prerequisites in
proc_auditing-llm-proxy-transactions.adoc so they require the minimum
namespace-scoped role needed to read proxy pod logs in the MTA namespace, rather
than cluster-admin; keep cluster-admin only for the later forwarding setup
section if needed. Reference the prerequisites list and the oc logs workflow,
and make the role requirement specific to the log-reading step instead of the
broader cluster-wide access.
- Around line 170-210: The ClusterLogForwarder example in the proxy-auditing doc
hard-codes the pod selector label, which may not match the actual proxy
workload. Update the selector in the example to use a placeholder such as
__<proxy_workload_label>__ instead of app: mta-ui-proxy, and keep the
surrounding guidance in sync by referring readers to verify the label before
applying the ClusterLogForwarder resource.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: fb7c899a-f543-41b7-89c5-666f2fb4f52e
📒 Files selected for processing (2)
docs/developer-lightspeed-guide/master.adocdocs/topics/developer-lightspeed/proc_auditing-llm-proxy-transactions.adoc
Pkylas007
left a comment
Pkylas007
left a comment
There was a problem hiding this comment.
Only a few minor suggestions and clarifications, thank you!
rromannissen
left a comment
rromannissen
left a comment
There was a problem hiding this comment.
Looks good to me, although I would defer to Engineering for technical validation. Only one small request to be more accurate with the Hub as OIDC provider.
|
|
||
| Credential isolation:: LLM provider API keys are stored in a Kubernetes secret and never distributed to client applications. Only the proxy pod reads these credentials. | ||
|
|
||
| JWT-based authentication:: When authentication is enabled, the proxy validates every incoming request against the Hub's Keycloak instance by using its JWKS endpoint: |
There was a problem hiding this comment.
The dependency for Keycloak is being removed in MTA 8.2. It would be more accurate to say something like "the Hub's OIDC provider".
There was a problem hiding this comment.
I am trying to get this into 8.1 docs
Signed-off-by: A.Arnold <anarnold@redhat.com>
ea5d1d8 to
3731a39
Compare
|
|
||
| [NOTE] | ||
| ==== | ||
| As of MTA 8.2, OIDC user identity is terminated at the Hub and is not passed to or stored by the proxy. |
There was a problem hiding this comment.
| As of MTA 8.2, OIDC user identity is terminated at the Hub and is not passed to or stored by the proxy. | |
| As of {ProductShortName} 8.2, OpenID Connect (OIDC) user identity is terminated at the Hub and is not passed to or stored by the proxy. |
4 participants
JIRA
PREVIEW
DESCRIPTION
Add documentation for LLM proxy interaction monitoring in the Developer Lightspeed guide (MTA-7134).
New content — proc_auditing-llm-proxy-transactions.adoc:
Request and data handling — documents how the proxy (built on llama-stack, running as a pod in the MTA namespace) handles credential isolation (API keys stored in a Kubernetes secret), JWT-based authentication via Keycloak/JWKS, header redaction, and data persistence in two PostgreSQL tables (llm_proxy_inference_store, llm_proxy_conversations)
Accessing proxy logs — step-by-step oc logs procedure for streaming current proxy pod output and retrieving logs from a previous (terminated) pod, with example output
Planned capabilities — documents future structured per-request audit logging, anonymized user-to-request correlation, and SIEM forwarding (Splunk/Elasticsearch via OpenShift Logging Operator) that are not yet in the current release
The new module is included at the end of docs/developer-lightspeed-guide/master.adoc, after the existing logs concept.